What it does
- Blocks common attack patterns in requests, like attempts to inject code into forms and addresses.
- Blocks or slows bots and repeated login attempts.
- Can apply quick “virtual patches” for newly published flaws before the software itself is updated.
- Often comes with a content delivery network that also speeds the site up and absorbs traffic floods.
What it doesn’t do
- Fix vulnerable software. A determined attacker can sometimes get past the rules.
- Protect a stolen password used normally.
- Clean a site that’s already hacked.
- Stop email attacks or domain hijacking.
Does a small site need one?
A WordPress or other plugin-based site that isn’t updated daily benefits from one. A site with no plugins, no admin login exposed and hosting on a modern network gets less from it, but the network in front of it usually provides similar protection anyway. In both cases, updates and monitoring matter more.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.